Examkin

All practice questions

1252 questions

All types1,252Multiple choice644Multiple select429True / False47Matching52Ordering80
Question 521Question →

Your company is planning to deploy a new Azure Kubernetes Service (AKS) cluster. Due to IP address constraints in your Azure Virtual Network, you decide to use the kubenet networking model.

Which two statements correctly describe how IP addresses are allocated in this configuration? (Select two.)

Select all that apply

Show answer & explanation

Answer: Nodes receive IP addresses from the Azure Virtual Network subnet.; Pods receive IP addresses from a separate, logically distinct address space.

Answer

Nodes receive IP addresses from the Azure Virtual Network subnet, and pods receive IP addresses from a separate, logically distinct address space.
In a kubenet networking model, the nodes receive IP addresses from the virtual network subnet, whereas the pods are assigned IP addresses from a logically distinct address space that is completely separate from the virtual network. This drastically reduces the number of IP addresses required from the virtual network subnet.

Step-by-Step Solution

1
Analyze the requirements for the AKS networking configuration.
The scenario specifies deploying an AKS cluster with limited IP address availability using the kubenet networking plugin.
Understanding the constraints is necessary to select the correct properties of kubenet.
2
Determine node IP address allocation for kubenet.
Under kubenet, nodes receive IP addresses from the Azure Virtual Network subnet.
Nodes must be reachable on the virtual network, so they are allocated standard subnet IPs.
3
Determine pod IP address allocation for kubenet.
Pods receive IP addresses from a separate address range that is not part of the Azure Virtual Network subnet.
This behavior reduces IP address consumption in the virtual network, making it suitable for environments with limited IPs.

Key Concept

IP address allocation differences between kubenet and Azure CNI in AKS
Question 522Question →

An organization has deployed a virtual network containing two subnets: WebSubnet (10.10.1.0/2410.10.1.0/24) and ApplianceSubnet (10.10.2.0/2410.10.2.0/24). A firewall virtual machine operating as a router is deployed in ApplianceSubnet with the IP address 10.10.2.10010.10.2.100. All outbound internet traffic from WebSubnet must pass through this router. Which two settings must be configured to achieve this routing flow? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Associate the route table with WebSubnet.; Add a route to the route table with the destination prefix 0.0.0.0/00.0.0.0/0, next hop type Virtual appliance, and next hop IP address 10.10.2.10010.10.2.100.

Answer

To redirect all outbound internet traffic from the WebSubnet through the firewall router, you must associate the custom route table with WebSubnet and add a route for destination 0.0.0.0/00.0.0.0/0 with the next hop type set to Virtual appliance and the next hop IP address set to 10.10.2.10010.10.2.100.
To override default system routing for internet-bound traffic from the WebSubnet, a User-Defined Route (UDR) must be applied. The custom route table must be associated with the subnet originating the traffic (WebSubnet). To direct this traffic to the firewall VM acting as a router, the route must target all destinations (0.0.0.0/00.0.0.0/0) using the 'Virtual appliance' next hop type with the firewall's private IP address (10.10.2.10010.10.2.100).

Step-by-Step Solution

1
Identify the source subnet and the next-hop target.
The source is WebSubnet (10.10.1.0/2410.10.1.0/24), and the target next-hop is the firewall router at 10.10.2.10010.10.2.100 in ApplianceSubnet.
Routing rules must be applied to the subnet where the traffic originates, and the route must point to the specific IP address of the firewall.
2
Define the route entry for internet traffic.
Create a route with destination prefix 0.0.0.0/00.0.0.0/0, next hop type 'Virtual appliance', and next hop IP address 10.10.2.10010.10.2.100.
The prefix 0.0.0.0/00.0.0.0/0 represents all internet traffic. Azure requires the 'Virtual appliance' next hop type when routing to a VM acting as a router.
3
Associate the route table with the source subnet.
Link the custom route table containing the new route to WebSubnet.
A route table has no effect until it is associated with one or more subnets.

Key Concept

Configuring custom routes (UDRs) to direct traffic through a Network Virtual Appliance (NVA).
Question 523Question →

An administrator is planning the deployment of a new web application to Azure App Service. The application hosting environment must meet the following requirements:
- Support automatic scaling of up to 15 instances during peak traffic.
- Support at least 5 staging slots for testing and deployment validation.
- Support daily automated backups of the application.
- Support hybrid connections to an on-premises database.
- The solution must not use a dedicated hosting environment (App Service Environment) to avoid high baseline costs.

Which of the following Azure App Service plan tiers meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Premium V2 (P1v2); Premium V3 (P1v3)

Answer

Premium V2 (P1v2) and Premium V3 (P1v3)
The Premium V2 (P1v2) and Premium V3 (P1v3) tiers both support the required features (up to 20 staging slots, daily automated backups, hybrid connections) and scale out to 20 and 30 instances respectively. They both operate in a multi-tenant infrastructure, satisfying the requirement to avoid dedicated environments like App Service Environments.

Step-by-Step Solution

1
Analyze the scale-out instance requirements.
The application requires scaling out to 15 instances. This rules out the Basic tier (max 3 instances) and the Standard tier (max 10 instances).
Only Premium (V2 or V3) and Isolated tiers can scale out to 15 or more instances.
2
Evaluate the requirement regarding dedicated hosting environments.
The requirement states the solution must not use a dedicated environment (App Service Environment). This rules out the Isolated V2 tier.
Isolated tiers run within an App Service Environment (ASE), which represents a dedicated environment and incurs higher baseline costs.
3
Verify feature compatibility for the remaining tiers.
Both Premium V2 (P1v2) and Premium V3 (P1v3) support up to 20 staging slots (meeting the 5-slot requirement), daily backups, hybrid connections, and run on multi-tenant infrastructure.
Both tiers meet all technical and cost constraint requirements.

Key Concept

Azure App Service plan tier capabilities, scaling limits, feature support, and multi-tenant vs. dedicated hosting models.
Estimated Time:2m 30s
Question 524Question →

You are configuring external collaboration settings in a Microsoft Entra ID tenant to control guest user permissions and invitation capabilities. Match each Microsoft Entra ID external collaboration setting to its corresponding behavior.

Click a left item, then click its matching right item

Items

Guest user access is restricted to properties and memberships of their own directory objects
Guest users have limited access to properties and memberships of directory objects
Only users assigned to specific admin roles can invite guest users
Anyone in the organization can invite guest users including guests and non-admins

Matches

Show answer & explanation

Answer

The setting restricting guest access to their own objects prevents guest users from viewing any other profiles. The limited access setting allows guests to see other users and groups but not group memberships they are not part of. Restricting invites to specific admin roles blocks standard members and limits invitations to administrators and Guest Inviters. The most inclusive setting allows guests to invite other guests.
The correct matches align each external collaboration setting with its documented functionality in Microsoft Entra ID. Restricting guest access to their own directory objects limits visibility to only their profile. Limited access (the default) allows basic search capability but blocks viewing memberships of non-joined groups. Limiting invitations to specific admin roles restricts B2B invites to admin roles and the Guest Inviter role, while the most permissive invitation setting allows guests themselves to invite others.

Step-by-Step Solution

1
Analyze guest user access restriction settings.
Identify that the setting restricting access to 'their own directory objects' isolates guest users completely, preventing them from viewing any other user profiles or group memberships.
This is the most restrictive option for guest permissions in Microsoft Entra ID.
2
Analyze default guest access settings.
Identify that 'limited access to properties and memberships' allows guest users to see basic properties of other users and groups but prevents viewing group memberships of groups they are not members of.
This represents the default tenant configuration for external collaboration.
3
Analyze guest invite permissions.
Determine that setting invitations to 'specific admin roles' prevents standard members and other guests from inviting B2B users, limiting this capability to administrators and the Guest Inviter role.
This enforces least privilege by disabling invitation rights for non-administrative members.
4
Evaluate tenant-wide collaboration settings.
Determine that enabling invitations for 'anyone in the organization including guests' allows existing B2B guests to invite new external users.
This is the most permissive setting for B2B collaboration.

Key Concept

Microsoft Entra ID External Collaboration Settings
Estimated Time:1m 30s
Question 525Question →

An administrator is configuring a virtual machine named VM-Prod-01 in the East US region. The virtual machine has a single network interface named nic-prod-01. The primary IP configuration, ipconfig-primary, on nic-prod-01 is associated with a Basic SKU public IP address. You need to add a secondary IP configuration named ipconfig-secondary to nic-prod-01. The secondary configuration must include a public IP address that supports zone redundancy, which requires a Standard SKU public IP. Which of the following actions must you perform to allow the association of the Standard SKU public IP address with the secondary configuration?

Show answer & explanation

Answer: Dissociate the Basic SKU public IP address from the primary configuration, upgrade it to the Standard SKU, and then associate the Standard SKU public IP addresses.

Answer

Dissociate the Basic SKU public IP address from the primary configuration, upgrade it to the Standard SKU, and then associate the Standard SKU public IP addresses.
The correct action is to dissociate the Basic SKU public IP from the primary configuration, upgrade it to the Standard SKU, and then associate the Standard SKU public IPs. Azure requires all public IP addresses associated with a virtual machine (whether on the same network interface or across multiple network interfaces) to use the same SKU. To upgrade a Basic SKU public IP to a Standard SKU, it must first be dissociated from the network interface. Once upgraded, both configurations can successfully use Standard SKU public IP addresses, which support the required zone redundancy.

Step-by-Step Solution

1
Identify the SKU mismatch constraint in Azure virtual machine network configurations.
Determine that all public IP addresses associated with a virtual machine's network interfaces must share the same SKU (either all Basic or all Standard).
Mixing Basic SKU and Standard SKU public IPs on a single virtual machine or a single network interface is not supported.
2
Formulate the upgrade path for the existing Basic SKU public IP address.
Determine that the Basic SKU public IP must be upgraded to Standard SKU, and that this upgrade requires the public IP to be in a dissociated state.
Azure requires a public IP address to be dissociated from any resource before its SKU can be upgraded from Basic to Standard.
3
Execute the dissociation, upgrade, and reassociation steps.
Dissociate the primary public IP, perform the SKU upgrade to Standard, and then associate the Standard SKU public IPs to both configurations.
This aligns the SKUs of all public IPs on the network interface to Standard, satisfying both the SKU consistency requirement and the zone-redundancy requirement.

Key Concept

Public IP SKU alignment and configuration constraints on Azure network interfaces
Question 526Question →

An administrator manages a web app hosted on an Azure App Service plan named ASP1. ASP1 is currently configured on the Basic (B1) pricing tier. You need to configure the hosting environment to meet the following requirements:
- Enable testing of web app updates in a staging slot before swapping to production.
- Enable automatic scale-out based on CPU utilization.
- Minimize costs.
Which two actions should you perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Scale up ASP1 to the Standard (S1) pricing tier.; Configure autoscale rules for ASP1.

Answer

Scale up ASP1 to the Standard (S1) pricing tier and configure autoscale rules for ASP1.
To satisfy both requirements (deployment slots and automatic scaling) at the lowest cost, you must scale up the App Service plan from Basic (B1) to Standard (S1). The Standard tier is the minimum tier that supports up to 55 deployment slots and autoscale rules. Once scaled up, you must configure autoscale rules to enable the automatic scaling behavior based on CPU utilization.

Step-by-Step Solution

1
Analyze the requirements for the App Service plan configuration.
The requirements are 55 deployment slots (staging environment), automatic scale-out based on CPU utilization, and cost minimization.
This determines the minimum pricing tier and configuration changes needed.
2
Compare the capabilities of Azure App Service pricing tiers against the requirements.
The Basic (B1) tier does not support deployment slots or autoscale (only manual scale up to 33 instances). The Standard (S1) tier is the lowest and most cost-effective tier that supports both deployment slots (up to 55) and autoscale (up to 1010 instances).
Choosing the most cost-effective tier ensures budget optimization while meeting all technical requirements.
3
Identify the configuration steps needed to complete the setup.
Scaling up the App Service plan to the Standard (S1) pricing tier must be performed, followed by configuring autoscale rules.
Scaling up unlocks the features, and configuring autoscale rules enables the automatic scale-out behavior.

Key Concept

Azure App Service pricing tier capabilities, specifically comparing Basic (B1) and Standard (S1) features such as deployment slots and autoscale configuration.
Estimated Time:1m 0s
Question 527Question →

An Azure administrator configures three virtual networks in the East US region as follows:

* VNet1 (10.10.0.0/1610.10.0.0/16) contains a subnet named Subnet1 (10.10.1.0/2410.10.1.0/24) with a virtual machine named VM1 (10.10.1.410.10.1.4).
* VNet2 (10.20.0.0/1610.20.0.0/16) contains a subnet named Subnet2 (10.20.1.0/2410.20.1.0/24) with a virtual machine named VM2 (10.20.1.410.20.1.4).
* VNet3 (10.30.0.0/1610.30.0.0/16) contains a subnet named Subnet3 (10.30.1.0/2410.30.1.0/24) with a virtual machine named VM3 (10.30.1.410.30.1.4).

The administrator establishes the following configuration:

1. Virtual network peering is configured between VNet1 and VNet2. The peering settings are:
* Peering from VNet1 to VNet2: 'Allow forwarded traffic' is enabled; 'Use remote gateways' is disabled.
* Peering from VNet2 to VNet1: 'Allow forwarded traffic' is enabled; 'Allow gateway transit' is disabled.
2. Virtual network peering is configured between VNet2 and VNet3. The peering settings are:
* Peering from VNet2 to VNet3: 'Allow forwarded traffic' is enabled; 'Allow gateway transit' is disabled.
* Peering from VNet3 to VNet2: 'Allow forwarded traffic' is enabled; 'Use remote gateways' is disabled.
3. IP forwarding is enabled on the network interface of VM2, and the operating system inside VM2 is configured to route traffic (functioning as a Network Virtual Appliance).
4. A route table named RT1 is created with a user-defined route for prefix 10.30.0.0/1610.30.0.0/16 pointing to the private IP address of VM2 (10.20.1.410.20.1.4) as the Next Hop. RT1 is associated with Subnet1.

Based on this scenario, is the statement that VM1 can establish a successful bidirectional ping with VM3 true or false?

Show answer & explanation

Answer: False

Answer

The statement is false because network communication requires bidirectional pathing, and there is no return route configured on Subnet3 for traffic destined to VNet1.
The correct answer is that the statement is false. Bidirectional traffic flow requires both outbound and inbound routing configurations to be complete. Since virtual network peering is non-transitive, VNet3 cannot reach VNet1 directly. Without a user-defined route on Subnet3 directing return traffic to the network virtual appliance (VM2), the ping response packets are dropped at the destination subnet.

Step-by-Step Solution

1
Evaluate the outbound route from the source virtual machine.
VM1 sends an ICMP echo request to VM3 (10.30.1.410.30.1.4). The request matches the user-defined route in route table RT1 associated with Subnet1. The route directs the packet to the next hop VM2 (10.20.1.410.20.1.4) in VNet2.
To verify if the outbound packet correctly leaves Subnet1 and identifies its next hop.
2
Evaluate the forwarding capability of the Network Virtual Appliance (NVA).
VM2 receives the packet. Since IP forwarding is enabled on its network interface, it accepts the packet and processes it for routing. Because VNet2 is directly peered with VNet3, VM2 utilizes the system route for VNet3 (10.30.0.0/1610.30.0.0/16 via VNet peering) and successfully forwards the packet to VM3 (10.30.1.410.30.1.4).
To verify if the NVA can forward the transit packet across the peering link to the destination virtual network.
3
Evaluate the return route from the destination virtual machine.
VM3 receives the ICMP echo request and attempts to send a reply back to VM1 (10.10.1.410.10.1.4). VM3 checks the routing table of Subnet3. Because virtual network peering is non-transitive, VNet3 has system routes only for its own space and directly peered spaces (VNet2), but not for VNet1. Without a user-defined route on Subnet3 for 10.10.0.0/1610.10.0.0/16, VM3 has no path to VM1.
To verify if the destination subnet has the necessary routing information to return traffic to the source network.
4
Determine the final bidirectional connectivity status.
The return packet is dropped at Subnet3, preventing the bidirectional ping from completing successfully.
To conclude the status of the connection based on the analysis of both directions.

Key Concept

Azure virtual network peering is non-transitive, and configuring custom transit routing requires User-Defined Routes (UDRs) on all participating subnets to establish bidirectional communication paths.
Question 528Question →

An administrator plans to deploy a new Azure virtual machine named VM1 in the West US 3 region. VM1 will host a database workload that requires high-performance storage using Ultra Disk managed disks.

Which two configurations should the administrator perform during the deployment of VM1 to support the use of Ultra Disks? (Select two.)

Select all that apply

Show answer & explanation

Answer: Select a virtual machine size that supports Ultra Disk compatibility.; Enable Ultra Disk compatibility in the disk configuration settings.

Answer

To support Ultra Disks on the virtual machine, the administrator must select a supported virtual machine size and enable Ultra Disk compatibility in the disk configuration settings.
The correct options are selecting a virtual machine size that supports Ultra Disk compatibility and enabling Ultra Disk compatibility in the disk settings. Ultra Disks have specific hardware requirements and must be enabled at the VM level to allow data disks of this type to be attached.

Step-by-Step Solution

1
Select a compatible virtual machine size during deployment.
Ensures that the compute resource supports the high-performance capabilities of Ultra Disks.
Ultra Disks are only compatible with specific virtual machine series and sizes.
2
Enable Ultra Disk compatibility on the virtual machine's settings.
Allows Ultra Disks to be selected and attached as data disks to the virtual machine.
This compatibility setting must be explicitly turned on during provisioning to make the option available.

Key Concept

Azure Ultra Disk configuration requirements
Question 529Question →

You have an Azure App Service web app named app-portal-prod that currently runs on the Basic B1 App Service plan. You need to implement a deployment slot named staging for testing. The staging slot must use a staging database, and the production slot must use a production database. These connection strings must remain with their respective slots after a slot swap operation. Which two actions should you perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Scale up the App Service plan to the Standard S1 pricing tier.; Configure the connection strings in both slots and select the 'Deployment slot setting' option for each.

Answer

Scale up the App Service plan to the Standard S1 pricing tier, and configure the connection strings in both slots and select the 'Deployment slot setting' option for each.
To use deployment slots, the App Service web app must run on a Standard, Premium, or Isolated App Service plan. Since the web app currently runs on a Basic B1 plan, scaling up to the Standard S1 tier is required to enable this capability. Additionally, by default, connection strings are swapped when a slot swap occurs. To ensure the production slot always points to the production database and the staging slot always points to the staging database, you must configure the connection strings in both slots as 'Deployment slot settings', which makes them sticky to the slot and prevents them from being swapped.

Step-by-Step Solution

1
Determine the minimum App Service plan pricing tier required for deployment slots.
Identify that the Basic B1 tier does not support deployment slots. You must scale up the App Service plan to at least the Standard S1 tier.
Deployment slots are only available in Standard, Premium, and Isolated App Service plans.
2
Configure the connection strings to be sticky to their respective slots.
In both the production slot and the staging slot, define the database connection string, and check the 'Deployment slot setting' checkbox for each.
By default, connection strings are swapped during a slot swap. Setting the 'Deployment slot setting' (also known as a slot-sticky setting) ensures the configuration remains with the slot and is not swapped.

Key Concept

Deployment slots require a Standard tier or higher App Service plan, and settings like connection strings must be explicitly configured as 'Deployment slot settings' to prevent them from being swapped.
Question 530Question →

You are deploying a new Azure Kubernetes Service (AKS) cluster to host a microservice workload. The network routing requirements are as follows:
- The node pool must be deployed inside an existing virtual network subnet with the CIDR block 10.240.0.0/2710.240.0.0/27 (which provides 3030 usable IP addresses).
- The cluster must be able to scale up to 120120 Pods during peak traffic.
- Pods must not be assigned IP addresses directly from the virtual network subnet to prevent IP address exhaustion.

Which network configuration should you select for the AKS cluster?

Show answer & explanation

Answer: Kubenet networking

Answer

Kubenet networking
Kubenet networking is the correct choice because it uses an overlay network where only the Kubernetes nodes receive IP addresses from the subnet (10.240.0.0/2710.240.0.0/27). The Pods are assigned IP addresses from a separate, logically distinct address range that is not routed directly in the virtual network, thereby conserving the limited IP addresses in the subnet.

Step-by-Step Solution

1
Analyze the subnet size and IP requirements.
The subnet CIDR block is 10.240.0.0/2710.240.0.0/27, providing only 3030 usable IP addresses, while the application requires scaling up to 120120 Pods.
This establishes that we cannot use a network model where every Pod consumes a subnet IP address.
2
Evaluate the IP allocation behavior of Kubenet.
In Kubenet, only nodes receive IP addresses from the subnet, while Pods receive IPs from a separate logical address space (overlay).
This allows the nodes to fit in the 10.240.0.0/2710.240.0.0/27 subnet while the Pods run on a separate private IP range, satisfying the constraint.
3
Evaluate the IP allocation behavior of Azure CNI options.
Azure CNI and its variations assign IP addresses to Pods directly from the virtual network subnets, which would lead to IP exhaustion in this scenario.
This rules out Azure CNI and its variants.

Key Concept

Kubenet vs. Azure CNI IP Address Allocation
Question 531Question →

You are managing the network resources for a web application. You deploy a Standard load balancer named LB1. You intend to add the network interfaces of two virtual machines, VM1 and VM2, to the backend pool of LB1. Both virtual machines currently have public IP addresses assigned to their network interfaces. However, when attempting to add the virtual machines to the backend pool of LB1, the operation fails with a compatibility error. You need to ensure both virtual machines can be added to the backend pool of LB1. What should you do?

Show answer & explanation

Answer: Reconfigure the public IP addresses associated with the network interfaces of VM1 and VM2 to use the Standard SKU.

Answer

Reconfigure the public IP addresses associated with the network interfaces of VM1 and VM2 to use the Standard SKU.
The correct configuration requires that all public IP addresses associated with resources in the backend pool of a Standard Load Balancer must match the Standard SKU of the load balancer itself. Reconfiguring the public IP addresses on the virtual machines' network interfaces to the Standard SKU satisfies this requirement and allows them to be added to the backend pool.

Step-by-Step Solution

1
Identify the SKU of the load balancer and the SKU of the public IP addresses associated with the virtual machines in the backend pool.
The load balancer uses the Standard SKU, while the virtual machines use Basic SKU public IP addresses.
Standard Load Balancers have strict SKU matching requirements for all associated public IP addresses.
2
Determine the compatible public IP configuration for a Standard Load Balancer.
All public IP addresses associated with the backend pool network interfaces must be of the Standard SKU.
Mixing Basic and Standard SKUs within a Standard Load Balancer backend pool is not supported by Azure.
3
Reconfigure or recreate the public IP addresses on VM1 and VM2's network interfaces.
The public IP addresses are updated to the Standard SKU, allowing the virtual machines to be successfully added to the backend pool.
Aligning the SKUs resolves the compatibility block and completes the backend pool configuration.

Key Concept

Standard Load Balancers require Standard SKU public IP addresses for all resources in their backend pool that have public IP associations. Standard and Basic SKUs cannot be mixed.
Question 532Question →

You are configuring an Azure Virtual Machine Scale Set (VMSS) named `vmss-sales` that uses Uniform orchestration, has an initial instance count of 1010, and uses an Automatic upgrade policy. The scale set is deployed in a subnet that has only 55 available private IP addresses. You plan to configure an autoscale rule to scale out the VMSS by 44 instances. You need to ensure that the scale-out operation succeeds without failing due to a lack of available IP addresses. Which configuration change should you apply to the scale set?

Show answer & explanation

Answer: Set the `overprovision` property of the scale set to `false`.

Answer

Set the `overprovision` property of the scale set to `false`.
The correct option is to set the `overprovision` property of the scale set to `false`. By default, Virtual Machine Scale Sets have overprovisioning enabled, which means Azure provisions more VMs than requested to speed up deployment times. Once the requested number of instances are healthy, the extra instances are deleted. In a subnet with constrained IP availability (only 55 IPs available), overprovisioning 44 instances could cause the deployment to fail because the total number of provisioned VMs during the operation might exceed 55. Disabling overprovisioning ensures exactly 44 instances are provisioned, consuming only 44 IP addresses.

Step-by-Step Solution

1
Analyze the subnet IP capacity and the scale-out requirement.
The subnet has 55 available private IP addresses, and the scale-out event requires 44 new instances.
Before configuring scaling, you must verify if the subnet has enough capacity for the target instance count.
2
Identify the cause of potential IP exhaustion during scale-out.
By default, Azure VMSS has overprovisioning enabled (`overprovision` = `true`), which spins up more instances than requested (e.g., 55 or 66 instances for a 44-instance request) to speed up deployment times.
Overprovisioning consumes extra IP addresses temporarily, which will fail if only 55 IPs are available and the overprovisioned count exceeds 55.
3
Disable overprovisioning in the VMSS configuration.
Setting `overprovision` to `false` ensures that Azure only attempts to provision exactly 44 instances, utilizing exactly 44 IP addresses.
This guarantees that the scale-out operation stays within the subnet's limit of 55 available IP addresses.

Key Concept

Disabling VMSS overprovisioning to prevent IP exhaustion in constrained subnets during scale-out operations.
Question 533Question →

You manage an Azure environment containing a virtual machine named VM-Prod1. The network interface of VM-Prod1 is currently a member of the backend pool of a Basic Load Balancer. You need to assign a new public IP address directly to the network interface of VM-Prod1. The public IP address must support zone redundancy. What should you do first?

Show answer & explanation

Answer: Remove VM-Prod1 from the backend pool of the Basic Load Balancer.

Answer

Remove VM-Prod1 from the backend pool of the Basic Load Balancer.
To support zone redundancy, a Standard SKU public IP address is required. However, Azure restricts the mixing of Basic and Standard SKUs on resources associated with the same virtual machine. Because the virtual machine is currently in the backend pool of a Basic Load Balancer, a Standard SKU public IP cannot be assigned to it. Removing the virtual machine from the Basic Load Balancer's backend pool resolves the SKU conflict and allows the Standard SKU public IP to be successfully attached.

Step-by-Step Solution

1
Identify the SKU requirement for the new public IP address.
Since the public IP address must support zone redundancy, a Standard SKU public IP address must be used (Basic SKU public IPs do not support zone redundancy).
To ensure the configuration meets the technical requirements of the scenario.
2
Analyze SKU compatibility rules for virtual machine network interfaces.
Azure dictates that all public IP associations on a virtual machine (whether directly assigned to the NIC or via a load balancer) must use the same SKU.
To identify potential resource conflicts before applying configurations.
3
Resolve the SKU mismatch by removing the incompatible load balancer association.
Remove the virtual machine from the Basic Load Balancer's backend pool, allowing a Standard SKU public IP address to be associated with its network interface.
Because a VM associated with a Basic Load Balancer cannot accept a Standard SKU public IP.

Key Concept

Azure Public IP SKU compatibility and Load Balancer alignment
Question 534Question →

You have a web application named `app-portal` hosted on an Azure App Service plan named `asp-portal`. The App Service plan is currently configured for the Basic (B1B1) pricing tier.

You need to implement a deployment slot named `staging` for the web app and route 10%10\% of the production web traffic to the `staging` slot for testing purposes.

Which two actions should you perform? (Select two.)

Select all that apply

Show answer & explanation

Answer: Scale up the App Service plan `asp-portal` to the Standard (S1S1) pricing tier.; In the settings of `app-portal`, add a deployment slot named `staging` and set its Traffic % to 1010.

Answer

To configure the staging slot and route 10%10\% of the traffic, you must scale up the App Service plan to the Standard (S1S1) pricing tier and add the staging slot with the Traffic % set to 1010 on the App Service.
To use deployment slots, the App Service plan must be scaled up to at least the Standard (S1S1) tier, as the Basic (B1B1) tier does not support slots. Once scaled up, adding a slot and setting its Traffic % to 1010 natively routes that proportion of traffic to the slot.

Step-by-Step Solution

1
Identify the pricing tier requirement for deployment slots.
Determine that the current Basic (B1B1) tier does not support deployment slots, whereas the Standard (S1S1) tier or higher is required.
Deployment slots are a feature of Standard, Premium, and Isolated App Service plans.
2
Scale up the App Service plan `asp-portal`.
The plan is upgraded from Basic (B1B1) to Standard (S1S1).
Enables deployment slot functionality and traffic routing features on the App Service.
3
Add the deployment slot and configure traffic routing.
A deployment slot named `staging` is added to `app-portal`, and its routing percentage is set to 10%10\%.
Allows 10%10\% of incoming production traffic to be directed to the staging slot for testing.

Key Concept

App Service Deployment Slots and Pricing Tiers
Question 535Question →

You are the administrator for a Microsoft Entra ID tenant. You configure a Self-Service Password Reset (SSPR) policy that requires users to use at least two methods to reset their password. You enable the following authentication methods for SSPR:
- Email
- Mobile app notification
- Mobile app code

A user named User1 is in the group scoped for SSPR. User1 installs the Microsoft Authenticator app on their smartphone and registers it for both notifications and verification codes. User1 does not register any other authentication methods.

When User1 attempts to reset their password, they receive an error indicating they have not registered the required number of authentication methods.

What is the cause of this issue?

Show answer & explanation

Answer: The Microsoft Authenticator app notification and verification code are considered a single authentication method category, so User1 has only registered one method.

Answer

The Microsoft Authenticator app notification and verification code are considered a single authentication method category, so User1 has only registered one method.
The correct answer is that the Microsoft Authenticator app notifications and verification codes are both part of the mobile app authentication method category. When a Self-Service Password Reset (SSPR) policy requires two methods, the user must register two distinct categories of methods (such as Email and Mobile App). Registering two different options within the same category (e.g., both notification and verification code via the Authenticator app) only counts as one registered method.

Step-by-Step Solution

1
Analyze the SSPR policy requirements.
The SSPR policy requires a minimum of two authentication methods to be registered and used by the user.
This establishes the rule that a single registered method category will not be sufficient for User1 to reset their password.
2
Examine the authentication methods registered by User1.
User1 has registered the Microsoft Authenticator app, configuring both push notifications and verification codes.
To determine how many distinct method categories User1 has registered under Microsoft Entra ID SSPR rules.
3
Evaluate the registered methods against SSPR categorization.
In Microsoft Entra ID, both notifications and verification codes from the Authenticator app fall under the single 'Mobile app' authentication method category. Therefore, User1 is treated as having only one registered authentication method.
This explains why User1 fails the SSPR requirement and identifies that they must register an additional distinct method (like Email or Mobile phone) to meet the policy requirement.

Key Concept

Microsoft Entra ID SSPR authentication method categorization and registration requirements.
Estimated Time:1m 30s
Question 536Question →

Your company has an Azure subscription that contains a virtual network named `vnet-finance`. The virtual network is configured with the address space 192.168.32.0/22192.168.32.0/22. Currently, `vnet-finance` contains a subnet named `Subnet-Web` that uses the address range 192.168.32.0/24192.168.32.0/24. You need to configure two new subnets to support the deployment of an Azure Bastion host and an Azure VPN Gateway. Which two of the following subnets can you create in `vnet-finance` to support these deployments? (Select two.)

Select all that apply

Show answer & explanation

Answer: AzureBastionSubnet with the address range 192.168.34.0/26192.168.34.0/26; GatewaySubnet with the address range 192.168.33.0/27192.168.33.0/27

Answer

The correct subnets are the AzureBastionSubnet with the range 192.168.34.0/26 and the GatewaySubnet with the range 192.168.33.0/27.
The correct subnets are AzureBastionSubnet with range 192.168.34.0/26192.168.34.0/26 and GatewaySubnet with range 192.168.33.0/27192.168.33.0/27. The Azure Bastion subnet is valid because it is named exactly 'AzureBastionSubnet', has a prefix of at least /26/26, and is in an unallocated portion of the VNet. The VPN Gateway subnet is valid because it is named exactly 'GatewaySubnet', has a prefix of /29/29 or larger, and is also in an unallocated portion of the VNet.

Step-by-Step Solution

1
Determine the available address ranges in the virtual network.
The VNet has the address range 192.168.32.0/22192.168.32.0/22 (spans 192.168.32.0192.168.32.0 to 192.168.35.255192.168.35.255). The existing Subnet-Web occupies 192.168.32.0/24192.168.32.0/24 (spans 192.168.32.0192.168.32.0 to 192.168.32.255192.168.32.255). This leaves 192.168.33.0/24192.168.33.0/24, 192.168.34.0/24192.168.34.0/24, and 192.168.35.0/24192.168.35.0/24 completely unallocated.
This establishes the boundaries of free IP blocks to avoid overlapping subnet definitions.
2
Verify the subnet naming and sizing requirements for Azure Bastion.
Azure Bastion requires a dedicated subnet named exactly 'AzureBastionSubnet' and must be configured with a prefix size of /26/26 or larger. The option specifying AzureBastionSubnet with the range 192.168.34.0/26192.168.34.0/26 meets these criteria.
Azure Bastion requires at least a /26/26 address space for internal routing and scaling purposes.
3
Verify the subnet naming and sizing requirements for the Azure VPN Gateway.
The VPN Gateway requires a dedicated subnet named exactly 'GatewaySubnet' and must be configured with a prefix size of /29/29 or larger (Microsoft recommends /27/27 or /28/28). The option specifying GatewaySubnet with the range 192.168.33.0/27192.168.33.0/27 meets these requirements.
A dedicated GatewaySubnet is required to host the gateway instances and route hybrid connectivity traffic.

Key Concept

Azure virtual networks require dedicated, specifically named subnets with precise sizing constraints for native services like Azure Bastion (minimum /26 named AzureBastionSubnet) and VPN Gateway (minimum /29 named GatewaySubnet). All subnets inside a virtual network must have non-overlapping ranges.
Question 537Question →

Your company has an on-premises branch office file server named Server1. You deploy Azure File Sync to centralize files in an Azure file share named Share1. You install the Azure File Sync agent on Server1, register the server, and create a sync group named SyncGroup1 with Share1 configured as the cloud endpoint. You need to configure sync for a folder on Server1 at D:\Data. The configuration must ensure that volume D: always maintains at least 30%30\% free space, and files that have not been accessed for more than 45 days are tiered to the cloud. Which configuration should you perform?

Show answer & explanation

Answer: Create a server endpoint for the path D:\Data in SyncGroup1. Enable cloud tiering, set the volume free space policy to 30%30\%, and enable the date policy with a threshold of 45 days.

Answer

Create a server endpoint for the path D:\Data in SyncGroup1, enable cloud tiering, set the volume free space policy to 30%30\%, and enable the date policy with a threshold of 45 days.
To satisfy the requirements, the local path D:\Data must be registered as a server endpoint within the sync group. Enabling cloud tiering with a volume free space policy of 30%30\% ensures that Azure File Sync maintains at least 30%30\% of the volume's storage capacity as free space. Additionally, enabling the date policy with a threshold of 45 days ensures that any file not accessed within the specified timeframe is tiered, provided it does not violate the volume free space policy.

Step-by-Step Solution

1
Identify the endpoint type for the local path.
The local path D:\Data must be configured as a server endpoint, because cloud endpoints in Azure File Sync can only represent Azure file shares.
Azure File Sync synchronizes data between cloud endpoints (Azure file shares) and server endpoints (directories on registered Windows Servers).
2
Configure the cloud tiering and volume free space policies.
Enable cloud tiering, configure the volume free space policy to 30%30\% to guarantee at least 30%30\% of the volume is kept free, and set the date policy to 45 days to tier inactive files.
Cloud tiering optimizes local disk usage by storing frequently accessed files locally while tiering infrequently accessed files to Azure Files based on volume free space and date-based policy limits.

Key Concept

Azure File Sync cloud tiering and endpoint configuration
Question 538Question →

You are designing the hosting infrastructure for a newly developed microservice that acts as an API gateway. The API gateway has the following specific requirements:
- It must support horizontal autoscaling up to 1212 instances to handle unpredictable traffic spikes.
- It requires at least 88 deployment slots to accommodate parallel integration testing pipelines.
- It must connect securely to resources in an Azure Virtual Network.

You need to select the most cost-effective pricing tier for the App Service plan.

Which pricing tier should you choose?

Show answer & explanation

Answer: Premium v2 (P1v2)

Answer

Premium v2 (P1v2)
The Premium v2 (P1v2) tier is correct because it supports up to 2020 deployment slots and up to 2020 scale-out instances, satisfying the requirements of 88 slots and 1212 instances respectively. It also supports Virtual Network integration, and is more cost-effective than the Premium v3 (P1v3) tier.

Step-by-Step Solution

1
Analyze the scaling requirement.
The application requires autoscaling up to 1212 instances. This eliminates Basic (B1) (which only supports manual scale up to 33 instances) and Standard (S1) (which only supports autoscaling up to 1010 instances).
To ensure the selected tier supports the minimum instance count required during peak load.
2
Analyze the deployment slots requirement.
The application requires 88 staging slots. This eliminates Basic (B1) (00 slots) and Standard (S1) (55 slots). Only Premium tiers (v2/v3 support up to 2020 slots) meet this criteria.
To verify that the chosen tier supports the development pipeline requirements.
3
Determine the most cost-effective tier that satisfies all criteria.
Both Premium v2 (P1v2) and Premium v3 (P1v3) satisfy all requirements, including VNet integration. Premium v2 (P1v2) is the most cost-effective choice as it is cheaper than Premium v3 (P1v3).
To fulfill the requirement of selecting the lowest cost tier that meets all operational needs.

Key Concept

Azure App Service plan tier features and limitations
Estimated Time:2m 0s
Question 539Question →

An administrator is configuring a new virtual network named `VNet1` in an Azure subscription to support a hybrid application architecture.

The virtual network has the following requirements:
- A subnet named `Subnet-Web` must host 1111 virtual machine instances that require private IP addresses.
- An Azure Bastion host must be deployed to provide secure connectivity to the virtual machines.
- A virtual network gateway must be deployed to support both an ExpressRoute connection and a VPN gateway in a coexisting configuration.
- Internal name resolution for resources in the virtual network must be resolved using an Azure Private DNS zone named `corp.internal`.

The administrator allocates the address block 10.150.20.0/2410.150.20.0/24 for `VNet1`.

Which two configurations should the administrator implement to meet the requirements while minimizing address space consumption? (Select two.)

Select all that apply

Show answer & explanation

Answer: `AzureBastionSubnet` configured with the address block 10.150.20.64/2610.150.20.64/26; `GatewaySubnet` configured with the address block 10.150.20.0/2710.150.20.0/27

Answer

The correct configurations are allocating a slash twenty-six address block for the subnet named AzureBastionSubnet, and allocating a slash twenty-seven address block for the subnet named GatewaySubnet.
The correct answers are the configurations specifying the Azure Bastion subnet as a slash twenty-six block and the GatewaySubnet as a slash twenty-seven block. Azure Bastion requires a dedicated subnet named exactly 'AzureBastionSubnet' with a subnet mask of slash twenty-six or larger. For the coexistence of an ExpressRoute gateway and a VPN gateway, Azure requires the subnet named 'GatewaySubnet' to have a prefix of slash twenty-seven or larger. Both of these configurations satisfy these requirements and fit within the parent address space without overlapping.

Step-by-Step Solution

1
Determine the sizing and naming requirements for the Azure Bastion subnet.
The subnet must be named exactly `AzureBastionSubnet` and have a prefix size of at least /26/26.
Azure Bastion requires a dedicated subnet with a prefix size of /26/26 or larger to accommodate its scale-out instances.
2
Determine the sizing and naming requirements for the GatewaySubnet under coexistence.
The subnet must be named exactly `GatewaySubnet` and have a prefix size of at least /27/27.
To support coexistence of an ExpressRoute gateway and a VPN gateway, Azure requires a gateway subnet of at least /27/27 or larger.
3
Evaluate the requirement for the Private DNS zone link.
The virtual network link must be associated with the virtual network `VNet1`.
Private DNS zones are linked at the virtual network level, not at the subnet level.
4
Perform subnetting design to ensure configurations fit within the 10.150.20.0/2410.150.20.0/24 address space without overlap.
`GatewaySubnet` allocated 10.150.20.0/2710.150.20.0/27 (IPs 10.150.20.010.150.20.0 to 10.150.20.3110.150.20.31), `AzureBastionSubnet` allocated 10.150.20.64/2610.150.20.64/26 (IPs 10.150.20.6410.150.20.64 to 10.150.20.12710.150.20.127), and `Subnet-Web` allocated 10.150.20.32/2810.150.20.32/28 (IPs 10.150.20.3210.150.20.32 to 10.150.20.4710.150.20.47). All fit cleanly with no overlaps.
To confirm that the chosen blocks are valid subnetting designs under the parent CIDR block.

Key Concept

Azure Virtual Network subnet sizing constraints, naming requirements, and service-specific restrictions (Azure Bastion, Gateway coexistence, and Private DNS linking).
Question 540Question →

An administrator is configuring a secondary IP configuration for an Azure virtual machine named VM-Db1. VM-Db1 has a single network interface named nic-db1. VM-Db1 is currently part of the backend pool of a Standard Load Balancer named LB-Prod. The administrator needs to configure a new IP configuration named ipconfig2 on nic-db1 to meet the following requirements:

- The private IP address of ipconfig2 must be set to 10.10.1.5010.10.1.50.
- The public IP address of ipconfig2 must be accessible from the internet.
- VM-Db1 must remain in the backend pool of LB-Prod.

Which configuration must the administrator apply to ipconfig2 and the associated public IP address?

Show answer & explanation

Answer: Set the private IP allocation of ipconfig2 to Static, and associate a Standard SKU public IP address with Static allocation.

Answer

Set the private IP allocation of ipconfig2 to Static, and associate a Standard SKU public IP address with Static allocation.
To satisfy the requirements, the private IP allocation must be set to Static to guarantee the assignment of 10.10.1.5010.10.1.50. Furthermore, because the virtual machine is in the backend pool of a Standard Load Balancer, any public IP address associated with the network interface must be of the Standard SKU. Standard SKU public IP addresses require Static allocation.

Step-by-Step Solution

1
Determine the required private IP allocation method.
Static allocation is required.
The requirement specifies a specific private IP address (10.10.1.5010.10.1.50). To ensure this exact address is assigned and does not change, Static allocation must be selected instead of Dynamic.
2
Determine the required SKU for the public IP address based on load balancer integration.
Standard SKU public IP is required.
VM-Db1 is a member of the backend pool of a Standard Load Balancer. Azure rules dictate that any public IP addresses associated with the network interfaces of VMs in a Standard Load Balancer backend pool must be Standard SKU. Basic SKU public IPs are incompatible in this scenario.
3
Determine the allocation method for the Standard SKU public IP address.
Static allocation is required.
Standard SKU public IP addresses in Azure are allocated statically to ensure the IP remains consistent and matches the lifecycle requirements of standard tier resources.

Key Concept

SKU alignment and IP allocation rules for Azure Virtual Machine NICs integrated with Standard Load Balancers.
PreviousPage 27 / 63Next
All practice questions — Microsoft Azure Administrator (AZ-104) | Examkin